2026-08-04_c9f30293f0b0cb87112c3e8e99824a76_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-04_c9f30293f0b0cb87112c3e8e99824a76_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc
Size 18.1MB
Sample260804-wtly3st1cs
SHA256 93dd3abdb5a667091e24aa691bbddbd4a6c431b67d088a2f2e36ba3e85f9bfbc
MD5 c9f30293f0b0cb87112c3e8e99824a76
SHA1 7748185bcda46c2eba03b51aa4f525e5fe857d3d
SHA512 6049b4a39e177d44b7e9201bd37f843c167039c98909faf0885a215b05e749e0fa9eae05c725dfdb25469cf8764b3b465a7c9ba39102451d61062906e1c73484
SSDEEP 196608:3Pq+b5Nt+8NxTrZY7tEZpVcE/Ks1Q+LG249JRscc2fxEU9eVTnXR:fq+b5aeOXET1hG249rscc2pvIph
TLSH
T1ED179E46F2A251E8D577C074C266AA17FB7438BD43502AF79AD19A746F23BE06D3B300
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-04_c9f30293f0b0cb87112c3e8e99824a76_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc

File Explorer

2026-08-04_c9f30293f0b0cb87112c3e8e99824a76_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc

.exe 18.1MB

2026-08-04_c9f30293f0b0cb87112c3e8e99824a76_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc

IMPHASH 5ecb9d8c57a022befb9eb2f6303ed3a9
SHA256 93dd3abdb5a667091e24aa691bbddbd4a6c431b67d088a2f2e36ba3e85f9bfbc
MD5 c9f30293f0b0cb87112c3e8e99824a76
SHA1 7748185bcda46c2eba03b51aa4f525e5fe857d3d
SHA512 6049b4a39e177d44b7e9201bd37f843c167039c98909faf0885a215b05e749e0fa9eae05c725dfdb25469cf8764b3b465a7c9ba39102451d61062906e1c73484
SSDEEP 196608:3Pq+b5Nt+8NxTrZY7tEZpVcE/Ks1Q+LG249JRscc2fxEU9eVTnXR:fq+b5aeOXET1hG249rscc2pvIph
TLSH
T1ED179E46F2A251E8D577C074C266AA17FB7438BD43502AF79AD19A746F23BE06D3B300
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

14251256

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

bcrypt

BCryptCloseAlgorithmProvider BCryptOpenAlgorithmProvider BCryptGenRandom

kernel32

GetLastError Process32NextW K32GetProcessMemoryInfo GetCurrentThread QueryPerformanceFrequency Process32FirstW CloseHandle CreateThread ExitProcess GetComputerNameW GetCurrentProcessId CreateProcessW WideCharToMultiByte QueryFullProcessImageNameW CreateProcessA SetProcessWorkingSetSize QueryPerformanceCounter GetTickCount MoveFileW GetProcessTimes GetExitCodeProcess ReleaseSRWLockExclusive AcquireSRWLockExclusive InitOnceBeginInitialize InitOnceComplete WakeConditionVariable WakeAllConditionVariable SleepConditionVariableSRW WaitForSingleObjectEx InitializeSRWLock InitializeConditionVariable GetModuleHandleW GetProcAddress FreeLibrary LoadLibraryExA LoadLibraryExW GetSystemDirectoryW CreateEventA GetStdHandle GetConsoleMode WriteConsoleW GetConsoleScreenBufferInfo GetTickCount64 GetProcessAffinityMask GetSystemTimeAsFileTime LoadLibraryA EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionAndSpinCount DeleteCriticalSection SetEvent ReleaseSemaphore CreateEventW CreateSemaphoreW LoadLibraryW GetThreadPriority SwitchToThread GetModuleHandleExW SetThreadErrorMode GetEnvironmentVariableA GetEnvironmentVariableW GetCurrentDirectoryW GetLocaleInfoW LCMapStringW CompareStringW TerminateProcess GetDateFormatW VirtualProtect HeapFree HeapAlloc SetFilePointerEx GetFileSizeEx UnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlCaptureContext MoveFileExW DeleteFileW GetTimeZoneInformation FileTimeToSystemTime SystemTimeToTzSpecificLocalTime PeekNamedPipe GetFileInformationByHandle Sleep MultiByteToWideChar CreateToolhelp32Snapshot OpenProcess ReleaseMutex GetCurrentThreadId WaitForSingleObject CreateMutexA FindClose CreatePipe SetThreadPriority SetConsoleTextAttribute GetModuleFileNameW ExpandEnvironmentStringsW WriteFile GetCurrentProcess FindNextFileW GetFullPathNameW SetPriorityClass SetHandleInformation RtlUnwind FindFirstFileW GetLogicalDrives ReadFile CreateDirectoryW IsValidLocale CreateFileW GetFileType FreeLibraryAndExitThread GetProcessHeap SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA ExitThread IsProcessorFeaturePresent FlsFree GetOEMCP GetACP FlsSetValue FlsGetValue FlsAlloc SetLastError RaiseException RtlPcToFileHeader RtlUnwindEx RtlLookupFunctionEntry InitializeSListHead GetStartupInfoW SetUnhandledExceptionFilter GetCPInfo CompareStringEx LCMapStringEx IsValidCodePage FindFirstFileExW HeapQueryInformation HeapSize HeapReAlloc SetEndOfFile SetStdHandle OutputDebugStringW ReadConsoleW GetConsoleOutputCP FlushFileBuffers GetUserDefaultLCID GetTimeFormatW DecodePointer EncodePointer InitializeCriticalSectionEx GetStringTypeW TryAcquireSRWLockExclusive GetSystemTimePreciseAsFileTime GetLogicalProcessorInformationEx EnumSystemLocalesW

user32

MessageBoxW EnumDisplayMonitors GetDC GetDesktopWindow GetWindowTextW SendInput ReleaseDC SetProcessDPIAware DrawIconEx wsprintfW OpenInputDesktop GetForegroundWindow FillRect GetCursorInfo CloseDesktop GetAsyncKeyState GetThreadDesktop SetThreadDesktop GetSystemMetrics GetMonitorInfoA GetIconInfo

gdi32

BitBlt CreateCompatibleBitmap SelectObject CreateCompatibleDC StretchBlt GetStockObject GetDIBits DeleteDC SetDIBitsToDevice GetObjectW SetStretchBltMode DeleteObject

advapi32

RegQueryValueExA RegOpenKeyExW RegOpenKeyExA RegQueryValueExW RegEnumKeyExW RegCloseKey RegCreateKeyExW RegSetValueExW OpenProcessToken GetTokenInformation

shell32

ShellExecuteExW ShellExecuteW SHFileOperationW

ole32

CoInitializeEx CreateStreamOnHGlobal CoTaskMemFree CoUninitialize CoCreateInstance StringFromGUID2

oleaut32

VariantInit VariantClear

d3d11

D3D11CreateDevice

ws2_32

WSAGetLastError setsockopt ioctlsocket freeaddrinfo htons getsockopt recv connect socket send WSAStartup getaddrinfo select closesocket WSACleanup

gdiplus

GdipGetImageEncoders GdipCloneImage GdipBitmapUnlockBits GdipAlloc GdiplusShutdown GdipFree GdipBitmapLockBits GdipGetImageEncodersSize GdiplusStartup GdipCreateBitmapFromScan0 GdipDisposeImage GdipSaveImageToStream

d3dcompiler_47

D3DCompile

rstrtmgr

RmRegisterResources RmGetList RmStartSession RmEndSession

winmm

waveInStop waveInGetNumDevs waveInClose timeBeginPeriod waveInAddBuffer waveInPrepareHeader waveInStart waveInOpen waveInGetDevCapsW waveInUnprepareHeader waveInReset

Name

.text

Size

13.9MB

Virtual Size

13.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

3.8MB

Virtual Size

3.8MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

20KB

Virtual Size

9.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

339KB

Virtual Size

338KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

64KB

Virtual Size

64KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-04_c9f30293f0b0cb87112c3e8e99824a76_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc

bcrypt

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

d3d11

ws2_32

gdiplus

d3dcompiler_47

rstrtmgr

winmm

generic